Network management method and related device

Abstract

This application provides a network management method and related equipment, relating to the field of computer network technology, aiming to solve the problem of how to optimize network management. The network management method includes: obtaining an APR table and a MAC table. The APR table stores the mapping relationship between IP addresses and MAC addresses. The MAC table stores the mapping relationship between VLAN IDs, MAC addresses, and switch ports. The mapping relationship between IP addresses, VLAN IDs, MAC addresses, and switch ports is determined based on the APR table and MAC table. When a change in the network environment is detected, the target switch port is determined, and a network change notification is issued. The target switch port is the switch port that has changed, or the switch port corresponding to the changed IP address or MAC address. The target switch port is disabled, or an isolated VLAN ID is assigned to the target switch port. This embodiment does not rely on the DHCP Option 82 function, reducing the hardware configuration requirements for the DHCP server and switches, thereby reducing network maintenance costs and improving network applicability.

Description

Technical Field

[0001] This application relates to the field of computer network technology, specifically to a network management method and related equipment. Background Technology

[0002] Most network management systems rely on Dynamic Host Configuration Protocol (DHCP) Option 82 to track and manage the Internet Protocol (IP) addresses of access devices. DHCP Option 82 allows embedding location information in DHCP messages, including the switch port and Virtual Local Area Network (VLAN) identifier corresponding to the access device, thus assisting network administrators in accurately locating access devices. DHCP Option 82 typically requires both the DHCP server and the switch to support DHCP Option 82 configuration, and requires resolving and storing location information by configuring DHCP server and switch parameters. However, not all switches on the market support DHCP Option 82 configuration, and configuring DHCP server and switch parameters is cumbersome, leading to higher network maintenance costs. Summary of the Invention

[0003] This application provides a network management method and related equipment, aiming to solve the problem of how to optimize network management.

[0004] The first aspect of this application provides a network management method, which includes: obtaining an Address Resolution Protocol (APR) table and a Media Access Control (MAC) table. The APR table stores the mapping relationship between IP addresses and MAC addresses. The MAC table stores the mapping relationship between VLAN IDs, MAC addresses, and switch ports. The mapping relationship between IP addresses, VLAN IDs, MAC addresses, and switch ports is determined based on the APR table and the MAC table. When a network environment change is detected, the target switch port is determined, and a network change notification is issued. The target switch port is the switch port that has changed, or the switch port corresponding to the changed IP address or MAC address. The target switch port is disabled, or an isolated VLAN ID is assigned to the target switch port.

[0005] In this embodiment, the mapping relationship between IP address, VLAN ID, MAC address, and switch port is determined based on the APR table and MAC table, thereby achieving precise location of access devices accessing the switch port. When the network environment changes, the target switch port is identified, and a network change notification is issued, thus promptly notifying the network administrator of the network environment changes. The target switch port can be disabled or assigned an isolated VLAN ID, thereby improving network security. Furthermore, this embodiment does not rely on the DHCP Option 82 function, reducing the hardware configuration requirements for the DHCP server and switch, thereby reducing network maintenance costs and improving network applicability.

[0006] In one embodiment, disabling a target switch port or assigning an isolated VLAN ID to a target switch port includes: disabling the target switch port when it is determined that the VLAN ID corresponding to the target switch port is greater than or equal to a threshold; and assigning an isolated VLAN ID to the target switch port when it is determined that the VLAN ID corresponding to the target switch port is less than a threshold.

[0007] In this embodiment, the target switch port is disabled when the VLAN ID corresponding to the target switch port is greater than or equal to a threshold, and an isolated VLAN ID is assigned to the target switch port when the VLAN ID corresponding to the target switch port is less than the threshold. This reduces VLAN resource consumption and improves network security.

[0008] In another embodiment, detecting changes in the network environment includes detecting changes in IP addresses, MAC addresses, switch ports, DHCP leases expiring, unauthorized DHCP services, or MAC addresses not listed in the MAC table.

[0009] In another embodiment, the unauthorized DHCP service includes a Rogue DHCP server assigning IP addresses to unauthorized access devices.

[0010] In another embodiment, a network change notification is used to indicate the reason for the network change. Reasons for network changes include IP address changes, MAC address changes, switch port changes, DHCP lease expiration, unauthorized DHCP service, and MAC addresses not listed in the MAC table.

[0011] A second aspect of this application provides a computer device that communicates with a DHCP server and a switch. The computer device includes a processor configured to: acquire an APR table from the DHCP server and a MAC table from the switch. The APR table stores the mapping relationship between IP addresses and MAC addresses. The MAC table stores the mapping relationship between VLAN IDs, MAC addresses, and switch ports. The mapping relationship between IP addresses, VLAN IDs, MAC addresses, and switch ports is determined based on the APR table and the MAC table. When a network environment change is detected, the target switch port is determined, and a network change notification is issued. The target switch port is the switch port that has changed, or the switch port corresponding to the changed IP address or MAC address. A disable command or an isolation command is sent to the switch. The disable command instructs the switch to disable the target switch port. The isolation command instructs the switch to assign an isolated VLAN ID to the target switch port.

[0012] A third aspect of this application provides a switch that communicates with a DHCP server. The switch includes a processor configured to: acquire a MAC table and an APR table from the DHCP server. The MAC table stores the mapping relationship between VLAN IDs, MAC addresses, and switch ports. The APR table stores the mapping relationship between IP addresses and MAC addresses. The mapping relationship between IP addresses, VLAN IDs, MAC addresses, and switch ports is determined based on the APR table and the MAC table. When a network environment change is detected, the target switch port is identified, and a network change notification is issued. The target switch port is the switch port that has changed, or the switch port corresponding to the changed IP address or MAC address. The target switch port is disabled, or an isolated VLAN ID is assigned to the target switch port.

[0013] A fourth aspect of this application provides a DHCP server that communicates with a switch. The DHCP server includes a processor configured to: acquire an APR table and a MAC table from the switch. The APR table stores the mapping relationship between IP addresses and MAC addresses. The MAC table stores the mapping relationship between VLAN IDs, MAC addresses, and switch ports. The mapping relationship between IP addresses, VLAN IDs, MAC addresses, and switch ports is determined based on the APR table and the MAC table. When a network environment change is detected, the target switch port is determined, and a network change notification is issued. The target switch port is the switch port that has changed, or the switch port corresponding to the changed IP address or MAC address. A disable command or an isolation command is sent to the switch. The disable command instructs the switch to disable the target switch port. The isolation command instructs the switch to assign an isolated VLAN ID to the target switch port.

[0014] A fifth aspect of this application provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the method provided in the first aspect.

[0015] A sixth aspect of this application provides a computer program product including computer instructions that, when executed by a processor, implement the method provided in the first aspect.

[0016] It is understood that the specific implementation methods and beneficial effects of the computer equipment provided in the second aspect, the switch provided in the third aspect, the DHCP server provided in the fourth aspect, the computer-readable storage medium provided in the fifth aspect, and the computer program product provided in the sixth aspect of the present application are largely the same as those of the method provided in the first aspect, and will not be repeated here. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the structure of a network management system provided as an example.

[0018] Figure 2 This is a schematic diagram of the structure of a network management system provided as another example.

[0019] Figure 3 This is a schematic diagram of the structure of a network management system provided as another example.

[0020] Figure 4 This is a flowchart of a network management method provided as an example.

[0021] Figure 5 This is a schematic diagram of a MAC table provided as an example.

[0022] Figure 6 This is a schematic diagram of an ARP table provided as an example.

[0023] Figure 7 This is a diagram illustrating how duplicate IPs can be displayed.

[0024] Figure 8 This is an example diagram showing the MAC addresses corresponding to duplicate IP addresses. Detailed Implementation

[0025] It should be noted that in the embodiments of this application, "several" refers to one or more, and "multiple" refers to two or more. The terms "first," "second," "third," "fourth," etc., in the specification, claims, and drawings of this application are used to distinguish similar objects, not to describe a specific order or sequence. The methods disclosed in the embodiments of this application, or the methods shown in the flowcharts, include one or more steps for implementing the method. Without departing from the scope of the claims, the execution order of multiple steps can be interchanged, and some steps can also be deleted.

[0026] In the embodiments of this application, computer equipment and access equipment include, but are not limited to, desktop computers, tablet computers, handheld computers, laptop computers, smartphones, intelligent robots, drones, mobile internet devices (MID), virtual reality (VR) devices, augmented reality (AR) devices, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical surgery, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, cellular phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs), handheld devices with wireless communication capabilities, in-vehicle devices, wearable devices, terminal devices in 5G networks, or public terrestrial mobile communication networks (Public Land Mobile). End devices in a network (PLMN).

[0027] The network management system of this application embodiment is described in detail below.

[0028] For example, such as Figure 1 As shown, the network management system 10 includes a DHCP server 110, a switch 120, a computer device 130, and several access devices 140.

[0029] DHCP server 110 stores an APR table, which is used to store the mapping relationship between IP addresses and MAC addresses.

[0030] Switch 120 includes several switch ports 121. Switch ports 121 are used to couple access devices 140. Switch 120 stores a MAC table, which stores the mapping relationship between VLAN IDs, MAC addresses, and switch ports 121.

[0031] Computer device 130 includes a first interface 131, a second interface 132, and a processor 133. The first interface 131 is used to couple a DHCP server 110. The second interface 132 is used to couple a switch 120. The processor 133 is electrically connected to the first interface 131 and the second interface 132.

[0032] In this embodiment, processor 133 sends an APR table request to DHCP server 110 through first interface 131 and a MAC table request to switch 120 through second interface 132. DHCP server 110 responds to the APR table request by sending an APR table to computer device 130. Switch 120 responds to the MAC table request by sending a MAC table to computer device 130. Processor 133 receives the APR table from DHCP server 110 through first interface 131 and the MAC table from switch 120 through second interface 132. Processor 133 determines the mapping relationship between IP address, VLAN ID, MAC address, and switch port 121 based on the APR table and MAC table, thereby achieving precise location of access device 140 accessing switch port 121.

[0033] When processor 133 detects a change in the network environment, it identifies the target switch port and issues a network change notification, thereby promptly notifying the network administrator of the network environment change. The target switch port is the switch port 121 that has changed, or the switch port 121 corresponding to the changed IP address or MAC address.

[0034] Among them, detected network environment changes include: detected IP address changes, MAC address changes, switch port 121 changes, DHCP lease expiration, unauthorized DHCP service, or MAC addresses not listed in the MAC table.

[0035] Understandably, DHCP server 110 records the DHCP lease corresponding to each IP address when assigning IP addresses. When the DHCP lease corresponding to an IP address expires, that IP address becomes invalid.

[0036] Unauthorized DHCP service includes rogue DHCP servers assigning IP addresses to unauthorized access devices. Unauthorized access devices refer to devices that have not been authenticated by the switch (i.e., illegal devices).

[0037] In some embodiments, a network change notification is used to indicate the reason for the network change. Reasons for network changes include changes in IP address, MAC address, switch port, DHCP lease expiration, unauthorized DHCP service, and MAC addresses not listed in the MAC table.

[0038] In this embodiment, after the processor 133 issues a network change notification, if the processor 133 does not detect any configuration changes in the switch 120 within a predetermined time period, it disables the target switch port or assigns an isolated VLAN ID to the target switch port, thereby improving network security.

[0039] Understandably, after processor 133 issues a network change notification, the network administrator may modify the configuration parameters of switch 120 to patch the security vulnerability. Modifying the configuration parameters of switch 120 includes disabling the target switch port or assigning an isolated VLAN ID to the target switch port.

[0040] In some embodiments, the processor 133 disables the target switch port or assigns an isolated VLAN ID to the target switch port, including: disabling the target switch port when it is determined that the VLAN ID corresponding to the target switch port is greater than or equal to a threshold; and assigning an isolated VLAN ID to the target switch port when it is determined that the VLAN ID corresponding to the target switch port is less than a threshold. The threshold can be set as needed.

[0041] This embodiment provides a detailed description of the network management system 10. In this embodiment, the computer device 130 serves as the management core of the network management system 10. In other embodiments, a DHCP server or switch may also serve as the management core of the network management system.

[0042] For example, such as Figure 2 As shown, the network management system 20 includes a DHCP server 210, a switch 220, and several access devices 230.

[0043] Switch 220 includes several switch ports 221. Switch ports 221 are used to couple access devices 230. Switch 220 stores a MAC table.

[0044] The DHCP server 210 includes an interface 211, a memory 212, and a processor 213. The interface 211 is used to couple the switch 220. The memory 212 is used to store the APR table. The processor 213 is electrically connected to the interface 211 and the memory 212.

[0045] In this embodiment, processor 213 sends a MAC table request to switch 220 via interface 211. In response to the MAC table request, switch 220 sends a MAC table to DHCP server 210. Processor 213 receives the MAC table from switch 220 via interface 211. Processor 213 determines the mapping relationship between IP address, VLAN ID, MAC address, and switch port 221 based on the MAC table and the APR table stored in memory 212, thereby achieving precise location of the access device 230 accessing switch port 221.

[0046] It is understandable that the function of processor 213 is... Figure 1 The function of the processor 133 in the computer device 130 is the same, and will not be described again here.

[0047] This embodiment provides a brief description of the network management system 20. In this embodiment, the DHCP server 210 serves as the management core of the network management system 20. The following is a brief description of a scenario where a switch serves as the management core of the network management system.

[0048] For example, such as Figure 3 As shown, the network management system 30 includes a DHCP server 310, a switch 320, and several access devices 330.

[0049] DHCP server 310 stores the APR table.

[0050] Switch 320 includes interface 321, memory 322, processor 323, and several switch ports 324. Interface 321 is used to couple DHCP server 310. Switch ports 324 are used to couple access devices 330. Memory 322 is used to store MAC tables. Processor 323 is electrically connected to interface 321, memory 322, and several switch ports 324.

[0051] In this embodiment, processor 323 sends an APR table request to DHCP server 310 via interface 321. DHCP server 310 responds to the APR table request by sending an APR table to switch 320. Processor 323 receives the APR table from DHCP server 310 via interface 321. Processor 323 determines the mapping relationship between IP address, VLAN ID, MAC address, and switch port 324 based on the APR table and the MAC table stored in memory 322, thereby achieving precise location of the access device 330 accessing switch port 324.

[0052] It is understandable that the function of processor 323 is related to Figure 1 The function of the processor 133 in the computer device 130 is the same, and will not be described again here.

[0053] The above embodiments provide a detailed description of the network management system. The following will use... Figure 1 The network management method of this application is specifically described using the network management system 10 shown as an example. The network management method is applied to... Figure 1 The internal processor 133 of the computer device 130.

[0054] For example, such as Figure 4 As shown, the network management method includes the following steps: S101. Obtain the APR table and MAC table.

[0055] The APR table stores the mapping between IP addresses and MAC addresses. The MAC table stores the mapping between VLAN IDs, MAC addresses, and switch ports.

[0056] S102. Determine the mapping relationship between IP address, VLAN ID, MAC address and switch port based on the APR table and MAC table.

[0057] S103. Determine if the network environment has changed.

[0058] If yes, proceed to steps S104-S105; otherwise, end. End means not executing subsequent steps.

[0059] In this embodiment, determining changes in the network environment includes: detecting changes in IP addresses, MAC addresses, switch ports, DHCP leases expiring, unauthorized DHCP services, or MAC addresses not listed in the MAC table.

[0060] S104. Determine the target switch port and issue a network change notification.

[0061] The target switch port is the switch port that has changed, or the switch port corresponding to the changed IP address or MAC address.

[0062] In this embodiment, the network change notification is used to indicate the reason for the network change. Reasons for network changes include IP address changes, MAC address changes, switch port changes, DHCP lease expiration, unauthorized DHCP service, and MAC addresses not listed in the MAC table.

[0063] S105. Determine whether the switch configuration will change within the predetermined time period.

[0064] If yes, then end; if no, proceed to step S106.

[0065] In this embodiment, after issuing a network change notification, the network administrator may change the switch configuration parameters, resulting in changes to the switch configuration.

[0066] S106. Determine whether the VLAN ID corresponding to the target switch port is greater than or equal to the threshold.

[0067] If yes, proceed to step S107; otherwise, proceed to step S108.

[0068] S107. Disable the target switch port.

[0069] S108. Assign an isolated VLAN ID to the target switch port.

[0070] In this embodiment, the mapping relationship between IP address, VLAN ID, MAC address, and switch port is determined based on the APR table and MAC table, thereby achieving precise location of access devices accessing the switch port. When the network environment changes, the target switch port is identified, and a network change notification is issued, thus promptly notifying the network administrator of the network environment change. If the network administrator has not changed the switch configuration parameters, the target switch port is disabled when the VLAN ID corresponding to the target switch port is greater than or equal to a threshold, and an isolated VLAN ID is assigned to the target switch port when the VLAN ID corresponding to the target switch port is less than the threshold, thereby reducing VLAN resource consumption and improving network security. Furthermore, this embodiment does not rely on the DHCPOption 82 function, reducing the hardware configuration requirements for the DHCP server and switch, thereby reducing network maintenance costs and improving network applicability.

[0071] The following is a brief description of network management methods using the scenario of detecting unauthorized DHCP service as an example.

[0072] For example, such as Figure 5 As shown, retrieve the MAC table, which stores the mapping relationship between VLAN IDs, MAC addresses, and switch ports. For example... Figure 6 As shown, retrieve the APR table, which stores the mapping relationship between IP addresses and MAC addresses. Figure 7 As shown, when a duplicate IP address is detected, it indicates an unauthorized DHCP service and displays the duplicate IP address. Figure 8 As shown, the MAC address corresponding to the duplicate IP address is determined based on the mapping relationship between IP address, VLAN ID, MAC address and switch port, and the MAC address corresponding to the duplicate IP address is displayed, thereby accurately locating the illegal device.

[0073] This embodiment provides a detailed description of the network management method. The network management method can also be applied to... Figure 2 The DHCP server 210 has a processor 213 inside, or is used in... Figure 3The switch 320 contains a processor 323. In other embodiments, the network management method may also be applied to a chip, a computer-readable storage medium, or a computer program product.

[0074] The chip includes a processor and an interface circuit, with the processor and interface circuit electrically connected. The interface circuit can read computer instructions stored in the memory and send the computer instructions to the processor. When the processor executes the computer instructions, it implements the network management method of this application embodiment.

[0075] A computer-readable storage medium stores computer instructions that, when executed by a processor, implement the network management method of the embodiments of this application.

[0076] Computer-readable storage media include volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information such as computer-readable instructions, data structures, program modules or other data. Computer-readable storage media include, but are not limited to, random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer.

[0077] The computer program product includes computer instructions that, when executed by a processor, implement the network management method of the embodiments of this application.

[0078] The embodiments of this application have been described in detail above with reference to the accompanying drawings. However, this application is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of this application.

Claims

1. A network management method, characterized in that, The method includes: Obtain the Address Resolution Protocol (APR) table and the Media Access Control (MAC) table. The APR table is used to store the mapping relationship between Internet Protocol (IP) addresses and MAC addresses, and the MAC table is used to store the mapping relationship between Virtual Local Area Network (VLAN) identifiers, MAC addresses, and switch ports. The mapping relationship between IP address, VLAN ID, MAC address and switch port is determined based on the APR table and the MAC table. When a change in the network environment is detected, the target switch port is determined, and a network change notification is issued; the target switch port is the switch port that has changed, or the switch port corresponding to the changed IP address or MAC address. Disable the target switch port, or assign an isolated VLAN ID to the target switch port.

2. The method as described in claim 1, characterized in that, Disabling the target switch port or assigning an isolated VLAN ID to the target switch port includes: When the VLAN ID corresponding to the target switch port is determined to be greater than or equal to the threshold, the target switch port is disabled; When it is determined that the VLAN ID corresponding to the target switch port is less than the threshold, an isolated VLAN ID is assigned to the target switch port.

3. The method as described in claim 1 or 2, characterized in that, The detected changes in the network environment include: The system detects a change in IP address, MAC address, switch port, expired Dynamic Host Configuration Protocol (DHCP) lease, unauthorized DHCP service, or MAC address not listed in the MAC table.

4. The method as described in claim 3, characterized in that, The unauthorized DHCP service includes: Rogue DHCP servers assign IP addresses to unauthorized access devices.

5. The method according to any one of claims 1, 2, and 4, characterized in that, The network change notification is used to indicate the reason for the network change. The reasons for the network change include IP address change, MAC address change, switch port change, DHCP lease expiration, unauthorized DHCP service, and MAC address not listed in the MAC table.

6. A computer device, characterized in that, It communicates with DHCP servers and switches. The computer device includes a processor, which is configured to: Obtain the APR table from the DHCP server and the MAC table from the switch. The APR table is used to store the mapping relationship between IP addresses and MAC addresses, and the MAC table is used to store the mapping relationship between VLAN ID, MAC address and switch port. The mapping relationship between IP address, VLAN ID, MAC address and switch port is determined based on the APR table and the MAC table. When a change in the network environment is detected, the target switch port is determined, and a network change notification is issued; the target switch port is the switch port that has changed, or the switch port corresponding to the changed IP address or MAC address. Send a disable command or an isolation command to the switch. The disable command is used to instruct the switch to disable the target switch port, and the isolation command is used to instruct the switch to assign an isolation VLAN ID to the target switch port.

7. A switch, characterized in that, It communicates with a DHCP server, and the switch includes a processor configured to: Obtain the MAC table and the APR table from the DHCP server. The MAC table is used to store the mapping relationship between VLAN ID, MAC address and switch port, and the APR table is used to store the mapping relationship between IP address and MAC address. The mapping relationship between IP address, VLAN ID, MAC address and switch port is determined based on the APR table and the MAC table. When a change in the network environment is detected, the target switch port is determined, and a network change notification is issued; the target switch port is the switch port that has changed, or the switch port corresponding to the changed IP address or MAC address. Disable the target switch port, or assign an isolated VLAN ID to the target switch port.

8. A DHCP server, characterized in that, It communicates with the switch, and the DHCP server includes a processor configured to: Obtain the APR table and the MAC table from the switch. The APR table is used to store the mapping relationship between IP addresses and MAC addresses, and the MAC table is used to store the mapping relationship between VLAN ID, MAC address and switch port. The mapping relationship between IP address, VLAN ID, MAC address and switch port is determined based on the APR table and the MAC table. When a change in the network environment is detected, the target switch port is determined, and a network change notification is issued; the target switch port is the switch port that has changed, or the switch port corresponding to the changed IP address or MAC address. Send a disable command or an isolation command to the switch. The disable command is used to instruct the switch to disable the target switch port, and the isolation command is used to instruct the switch to assign an isolation VLAN ID to the target switch port.

9. A computer-readable storage medium, characterized in that, It stores computer instructions that, when executed by a processor, implement the method as described in any one of claims 1-5.

10. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the method as described in any one of claims 1-5.

Images